summaryrefslogtreecommitdiffstats
path: root/src/evaluate.c
Commit message (Collapse)AuthorAgeFilesLines
* src: add level option to the log statementPablo Neira Ayuso2014-07-251-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is required if you use upcoming Linux kernels >= 3.17 which come with a complete logging support for nf_tables. If you use 'log' without options, the kernel logging buffer is used: nft> add rule filter input log You can also specify the logging prefix string: nft> add rule filter input log prefix "input: " You may want to specify the log level: nft> add rule filter input log prefix "input: " level notice By default, if not specified, the default level is 'warn' (just like in iptables). If you specify the group, then nft uses the nfnetlink_log instead: nft> add rule filter input log prefix "input: " group 10 You can also specify the snaplen and qthreshold for the nfnetlink_log. But you cannot mix level and group at the same time, they are mutually exclusive. Default values for both snaplen and qthreshold are 0 (just like in iptables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix concat expressions as map argumentsPatrick McHardy2014-07-101-0/+1
| | | | | | | | | | | | The type in the evaluation context needs to be reset to avoid treating the concatenation as a right hand side relational expression. # nft filter output mark set ip daddr . tcp dport map { 192.168.0.1 . 22 : 1 } <cmdline>:1:24-43: Error: datatype mismatch, expected packet mark, expression has type concatenation of (IPv4 address, internet network service) filter output mark set ip daddr . tcp dport map { 192.168.0.1 . 22 : 1 } ^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: revert broken reject icmp code supportPablo Neira Ayuso2014-06-201-17/+0
| | | | | | | | | | | | | | | | | This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: add ICMP code parameter for indicating the type of errorÁlvaro Neira Ayuso2014-06-161-2/+7
| | | | | | | | | | | | | | | | | | | | This patch allows to indicate the ICMP code field in case that we use to reject. Before, we have always sent network unreachable error as ICMP code, now we can explicitly indicate the ICMP code that we want to use. Examples: nft add rule filter input tcp dport 22 reject with host-unreach nft add rule filter input udp dport 22 reject with host-unreach In this case, it will use the host unreachable code to reject traffic. The default code field still is network unreachable and we can also use the rules without the with like that: nft add rule filter input udp dport 22 reject Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: Use protocol context for indicating the reject typeÁlvaro Neira Ayuso2014-06-161-0/+12
| | | | | | | | | This patch uses the protocol context to initialize the reject type considering if the transport protocol is tcp, udp, etc. Before this patch, this was left unset. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-251-0/+1
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add support for setting ct markArturo Borrero2014-03-131-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix expr_binary_error()-related compilation warningsArturo Borrero2014-03-121-38/+44
| | | | | | | | | | | | | | | | | | | | | | | | The commit e7b43ec0 [expr: make expr_binary_error() usable outside of evaluation] seem to change expr_binary_error() interface. Later, several compilation warning appears. The expr_binary_error() function and expr_error() macro both expect `struct list_head *', so I simply changed callers to send `ctx->msgs'. [...] src/evaluate.c: In function ‘byteorder_conversion’: src/evaluate.c:166:3: warning: passing argument 1 of ‘expr_binary_error’ from incompatible pointer type [enabled by default] In file included from src/evaluate.c:21:0: include/expression.h:275:12: note: expected ‘struct list_head *’ but argument is of type ‘struct eval_ctx *’ src/evaluate.c: In function ‘expr_evaluate_symbol’: src/evaluate.c:204:4: warning: passing argument 1 of ‘expr_binary_error’ from incompatible pointer type [enabled by default] In file included from src/evaluate.c:21:0: include/expression.h:275:12: note: expected ‘struct list_head *’ but argument is of type ‘struct eval_ctx *’ [...] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: properly account set size when merging recursive set definitionsPatrick McHardy2014-03-071-0/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: use flagcmp for single RHS bitmask expressionPatrick McHardy2014-02-171-1/+5
| | | | | | | | | | Always use flagcmp for RHS bitmask expressions, independant of whether only one or an entire list of bitmask expression is specified. This makes sure that f.i. "tcp flags ack" will match any combinations of ACK instead of ACK and only ACK. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: evaluate commands immediately after parsingPatrick McHardy2014-02-041-12/+1
| | | | | | | | | | | | | | | | | | | | | | | | We currently do parsing and evaluation in two seperate stages. This means that if any error occurs during parsing, we won't evaluate the syntactical correct commands and detect possible evaluation errors in them. In order to improve error reporting, change this to evaluate every command as soon as it is fully parsed. With this in place, the ruleset can be fully validated and all errors reported in one step: tests/error.1:6:23-23: Error: syntax error, unexpected newline filter input tcp dport ^ tests/error.1:7:24-26: Error: datatype mismatch, expected internet network service, expression has type Internet protocol filter input tcp dport tcp ~~~~~~~~~ ^^^ tests/error.1:8:24-32: Error: Right hand side of relational expression (==) must be constant filter input tcp dport tcp dport ~~~~~~~~~~^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: determine implicit relational op before RHS constant checksPatrick McHardy2014-02-041-11/+11
| | | | | | | | | | | | The symbol for the relational op is shown in the error message. Since OP_IMPLICIT doesn't have a symbol, (null) is shown. Fix by determining the implicit op before checking for constants. Error: Right hand side of relational expression ((null)) must be constant => Error: Right hand side of relational expression (==) must be constant Signed-off-by: Patrick McHardy <kaber@trash.net>
* ruleset: add XML/JSON exportArturo Borrero Gonzalez2014-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | This patch adds the following operation: :~# nft export <xml|json> The XML/JSON output is provided raw by libnftnl, thus without format. In case of XML, you can give format with the `xmllint' tool from libxml2-tools: :~# nft list ruleset xml | xmllint --format - In case of JSON, you can use `json_pp' from perl standar package: :~# nft list ruleset json | json_pp A format field is added in struct cmd, and it will be reused in the import operation. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd: add create command for tables and chainsPatrick McHardy2014-01-211-0/+1
| | | | | | | | | We currently always use NLM_F_EXCL for add, which makes adding existing chains or tables fail. There's usually no reason why you would care about this, so change "add" to not use NLM_F_EXCL and add a new "create" command in case you do care. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-0/+6
|\ | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * set: make set initializer parsablePatrick McHardy2014-01-161-0/+6
| | | | | | | | | | | | | | | | | | If a set contains elements, the output is not parsable since the elements = { ... } is not understood by the parser. Fix this and also add support for creating constant sets (which only makes sense when using an initializer). Signed-off-by: Patrick McHardy <kaber@trash.net>
* | nftables: add support for the "inet" familyPatrick McHardy2014-01-081-0/+1
| | | | | | | | | | | | | | | | | | | | Add support for the mixed IPv4/IPv6 "inet" family. This mainly consist of adding the "inet" <-> NFPROTO_INET mapping in the parser and netlink support functions. Additionally add the definitions for the inet filter table. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | ct expr: protocol context updates and dynamic typingPatrick McHardy2014-01-081-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Include the protocols defined through relational ct expressions in the protocol context and use the protocol context to dynamically determine the types of network and transport layer ct expression types. Before: $ nft filter output ct proto-dst ssh <cmdline>:1:28-30: Error: Can't parse symbolic invalid expressions filter output ct proto-dst ssh ^^^ $ nft filter output ip protocol tcp ct proto-dst ssh <cmdline>:1:44-46: Error: Can't parse symbolic invalid expressions filter output ip protocol tcp ct proto-dst ssh ^^^ $ nft filter output ct protocol tcp ct proto-dst ssh <cmdline>:1:44-46: Error: Can't parse symbolic invalid expressions filter output ct protocol tcp ct proto-dst ssh ^^^ After: $ nft filter output ct proto-dst ssh <cmdline>:1:28-30: Error: Can't parse symbolic invalid expressions filter output ct proto-dst ssh ^^^ $ nft filter output ip protocol tcp ct proto-dst ssh $ nft filter output ct protocol tcp ct proto-dst ssh Signed-off-by: Patrick McHardy <kaber@trash.net>
* | expr: add protocol context update callbackPatrick McHardy2014-01-081-11/+7
| | | | | | | | | | | | | | | | | | | | Add a callback function to the expression ops to update the protocol context for relational protocol expressions (EXPR_F_PROTOCOL). Also set the EXPR_F_PROTOCOL flag for IIFTYPE meta expressions to make sure the callback is invoked when necessary. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | nftables: generic procotol contextsPatrick McHardy2014-01-081-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the context of higher layer protocols is specific to payload expressions with some special cases for meta IIFTYPE expressions. This approach has a few shortcomings, concretely there are more expression types which define upper layer protocols like the ct expression and two upcoming new types for the meta expression. Replace the payload context by a generic protocol context to deal with this. This patch just splits off the requires parts from the payload expression without any functional changes, the following patches will add further functionality for other expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | src: add support for queueEric Leblond2014-01-041-0/+2
|/ | | | | | | | | | | This patch adds support for the queue target. It is now possible to specify rule sending packet to a given queue and using load balancing: nft add rule filter output queue num 3 total 2 options fanout Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for IPv6 NATEric Leblond2013-09-301-2/+6
| | | | | | | | This patch adds support for IPv6 NAT. It adds IPv6 support in evaluation and in delinearization which were the only missing parts. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-041-0/+43
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix range and comparison evaluationPablo Neira Ayuso2013-06-121-2/+2
| | | | | | | | | This patch fixes these two commands: nft add rule ip test test ip saddr 1.1.1.1-2.2.2.2 nft add rule ip test test ip saddr < 1.1.1.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: catch missing and excess elements in concatenationsPatrick McHardy2013-04-221-1/+13
| | | | | | | | | | | | | | # nft -nn filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh } <cmdline>:1:50-66: Error: datatype mismatch, expected concatenation of (IPv4 address, internet network service, internet network service), expression has type concatenation of (IPv4 address, internet network service) filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh } ^^^^^^^^^^^^^^^^^ # nft -nn filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} <cmdline>:1:76-78: Error: unexpected concat component, expecting concatenation of (IPv4 address, internet network service, internet network service) filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd/netlink: make sure we always have a location in netlink operationsPatrick McHardy2013-04-181-2/+2
| | | | | | Improve error reporting by always using a location in netlink operations. Signed-off-by: Patrick McHardy<kaber@trash.net>
* expr: fix concat expression type propagationPatrick McHardy2013-04-181-6/+21
| | | | | Dynamically instantiate a data type to represent all types of a concatenation and use that for type propagation.
* expr: kill EXPR_F_PRIMARYPatrick McHardy2013-04-151-3/+1
| | | | | | Not used anymore, kill it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: add rule insertion (prepend) supportPatrick McHardy2012-12-141-0/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* chains: add chain rename supportPatrick McHardy2012-12-141-0/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd: fix handle use after free for implicit set declarationsPatrick McHardy2012-12-101-1/+4
| | | | | | | | The implicit set declaration passes the set's handle to cmd_alloc(), which copies the pointers to the allocated strings. Later on both the set's handle and the commands handle are freed, resulting in a use after free. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: reenable adjacent payload mergingPatrick McHardy2012-12-091-0/+8
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* sets: fix sets using intervalsPatrick McHardy2012-12-091-1/+3
| | | | | | | | When using intervals, the initializers set_flags are set to SET_F_INTERVAL, however that is not propagated back to the set, so the segtree construction is not performed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: include verbose message in all BUG statementsroot2012-12-081-15/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: reintroduce type chekcs for relational expressionsPatrick McHardy2012-12-051-0/+27
| | | | | | | Since the parser can now generate constant expressions of a specific type not determinaed by the LHS, we need to check that relational expressions are actually using the correct types to avoid accepting stupid things like "tcp dport tcp".
* expression: Differentiate expr among anonymous structures in struct exprTomasz Bursztyka2012-08-031-10/+10
| | | | | | | This fixes compilation with gcc-4.7 Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Remove useless variable in expr_evaluate_bitwise()Tomasz Bursztyka2012-08-031-2/+1
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nat: validate protocol context when performing transport protocol mappingsPatrick McHardy2010-07-061-8/+19
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: properly parse debug levelsPatrick McHardy2010-07-061-14/+18
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* add support for new set API and standalone setsPatrick McHardy2009-07-281-35/+249
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* expressions: kill seperate sym_type datatype for symbolsPatrick McHardy2009-04-011-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: maintain table of all datatypes and add registration/lookup functionPatrick McHardy2009-03-311-4/+4
| | | | | | | | | | | Add a table containing all available datatypes and registration/lookup functions. This will be used to associate a stand-alone set in the kernel with the correct type without parsing the entire ruleset. Additionally it would now be possible to remove the global declarations for the core types. Not done yet though. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Fix multiple references to the same user defined symbolic expressionPatrick McHardy2009-03-201-2/+1
| | | | | | | | The expression needs to be cloned so transformations don't corrupt the original expression. This could be slightly optimized by only taking a reference and COW'ing when necessary (which is actually quite rare). Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add support for user-defined symbolic constantsPatrick McHardy2009-03-201-4/+33
| | | | | | | | | | | | | | | | | | User-defined constants can be used like this: define allowed_hosts = { 192.168.0.0/24, 10.0.0.20-10.0.0.30 } define udp_services = domain define tcp_services = { ssh, domain } ip saddr $allowed_hosts udp dport $udp_services counter accept ip saddr $allowed_hosts tcp dport $tcp_services counter accept Recursive definitions are possible, but currently not fully handled. Anything requiring transformations (sets using ranges) can not be used more than once currently since the expressions need to be COW'ed previously. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+1031
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 14:41:11 +0000